Chainalysis: Hackers using ‘never-seen-before laundering patterns’
US blockchain analysis firm Chainalysis has spotted that the hackers behind the Binance theft are using “ never-seen-before†patterns to launder the stolen assets and stay ahead of the authorities.
They report that thousands of transactions have taken place in a short period, suggesting the attackers are using automation to obscure the trail of funds.
Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Chainalysis explains:
double quotation mark While billions of dollars in crypto under their control were denominated in unfreezable cryptocurrencies like Bitcoin and Ethereum, billions more were held in stablecoins like USDT and USDC that can be frozen. It was only a matter of time before the issuers of those stablecoins would freeze those funds — in coordination with law enforcement and industry partners such as Chainalysis.Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets. Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH. Ten minutes later, the exploiter sent the remaining $175 million in stablecoins to stopover wallets, likely trying to move faster than a blacklist or freeze. But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
Key events
In the US, Commodity Futures Trading Commission (CFTC) chairman Michael Selig told reporters that “we have the ability to trace all this in the blockchainâ€.
Speaking to CNBC, Selig said it was “very concerning†that there had been “several cyber incidents involving crypto†and the CFTC has regulations in place to prevent this sort of attack.
He added that he wants to see a “federal option†so that people will register with the CFTC.
A summary
A quick catch-up, as I hand over to my colleague Tom Ambrose:
Hackers have stolen $6.3bn from Binance, the world's biggest cryptocurrency exchange, in what could be the largest theft ever.
The attack saw more than $6bn of crypto assets taken from Binance's own ‘hot wallet', apparently after a laptop belonging to one of Binance's development and operations engineers was compromised.
Binance has committed to cover losses from its company funds, and says it is working with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
The FBI have said it is:
double quotation mark “aware of the incident and ‌is engaged with relevant public and private partners to ​understand the scope of the activity, evaluate potential impacts, and coordinate appropriate â investigative stepsâ€.
The UK's financial watchdogs are also monitoring for any potential fallout from the Binance heist.
Co-CEO Richard Teng has said this afternoon that â the attacker used a self-destruct mechanism â that destroyed â tooling ​and traces as they went.
Teng also said Binance was conducting a full security review, and pledged:
double quotation mark “We will do everything in our power to make sure that these bad actors are held accountable.â€
Security experts said the hack was probably carried out by TraderTraitor, an elite north Korean hacking unit.
Chainalysis said the hackers appeared to be using “never-seen-before laundering patterns†to avoid the stolen funds being frozen, by switching stablecoins into non-freezable assets such as ethereum.
Crypto assets have dropped in value since news of the hack broke last night.
Here's the damage over the last 24 hours, from
-
Bitcoin: down 5.3% at $77,503.39
-
Ethereum: down 6% at $2,216.25
-
BNB: down 6.5% at $699.13
-
Solana: down 7.7% at $94.57
There's a risk that disruption in the cryptocurrency world spreads to mainstream finance, given financial institutions have been embracing crypto in recent years.
So explains professor Iwa Salami, professor of financial law and regulation and director of the Centre of FinTech at the University of East London (UEL):
double quotation mark “It would be misleading to suggest that mainstream finance, in the UK or internationally, is becoming reliant on crypto-assets. The growing interest among major financial institutions is primarily in blockchain technology and its applications, particularly asset tokenisation, payments and settlement. However, institutional exposure to crypto-assets, particularly Bitcoin and Ether, is also increasing through investment products and trading services.“As these links deepen, risks originating in crypto markets could increasingly spill over into traditional finance, potentially posing wider financial stability risks. This reinforces the importance of robust regulation, effective risk management and oversight of the growing interconnectedness between crypto markets and mainstream finance.â€
Tom Robinson, co-founder of analytics company Elliptic, has given the FT a pithy explanation of how hacking one developer's laptop would have let the attackers into Binance:
double quotation mark “Binance's engineers manage the systems that run the exchange.â€â€œA DevOps engineer's laptop typically holds the access needed to log into those systems. An attacker who controls that laptop can use the same access.â€
“They got Binance's own systems to send the money for them.
Binance is working with law enforcement, blockchain intelligence firms, token issuers and other exchange to trace and recover stolen funds, Richard Teng continues.
Teng says, in his video message:
double quotation mark “We will do everything in our power to make sure that these bad actors are held accountable.â€
Binance: We’re conducting a full security review
Richard Teng adds that Binance is rebuilding its withdrawal service.
It will not be switched back on until it passes “rigorous testingâ€, he says, but adds that he's “very hopeful†that users will be able to withdraw funds prior to the Sunday deadline.
Binance is also conducting a full security review, he continues.
And, the company intends to publish a proof of reserves report by Monday.
Binance: This was a complex attack
Richard Teng then confirms, in his video message, that the hack appears to have involve a compromised laptop – as reported a few hours ago.
However, he then reveals that Binance's investigation has also uncovered “additional points of breachâ€.
Teng says
double quotation mark This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they want, making it more difficult for us to trace and investigate.
Teng has also explained that the attacker ​used ‌a known ​multi-signature protocol, called ​eip-7702, to obtain on-chain execution approval over a hot wallet.
Binance’s Teng: We’re working ‘hand in hand’ with global law enforcement
Binance has released a new video message from co-CEO Richard Teng.
Teng starts by thanking Binance's users for their “patience and understandingâ€, as well as partners who froze assets stolen in the hack.
Teng says Binance is working “hand in hand†with global law enforcement “to seek justiceâ€.
He says:
double quotation mark Rest assured that we are working non-stop to resolve this, to make the users whole, and live up to your trust.I want to be clear, we are committed to covering all hacked losses through our company funds. Your assets are safe.
The good news is that Binance is recoving stolen assets for users, Teng adds.
He also explains that the hack hit Binance's own ‘hot wallet'.
The “vast majority†of customer funds are held in ‘cold wallets' and are moved to a hot one when a user makes a withdrawal, he explains.
[A hot wallet is one that is connected to the internet, while cold wallets remain offline where they should be protected from online hackers.]
FBI: We’re engaged with partners over Binance hack
The FBI has now confirmed it is looking into the Binance security breach.
The FBI said in a statement, via Reuters, that it was “aware of the incident and ‌is engaged with relevant public and private partners to ​understand the scope of the activity, evaluate potential impacts, and coordinate appropriate â investigative stepsâ€.
Strategy chair (and bitcoin zealot) Michael Saylor says Binance needs to deliver on its promise to compensate customers affected by the hack
Posting on X (as his company's share price drops around 10%), Saylor explains:
double quotation mark Binance has committed its own balance sheet to making customers whole. I expect it to deliver. Our industry will learn from this incident, strengthen security, and emerge stronger and more resilient.
As Strategy owns around 848,000 bitcoin, it needs this to happen!
Earlier today the cofounder and former CEO of Binance asked Elon Musk not to “troll†the company, and instead “show some supportâ€.
Changpeng Zhao appeared to be riled by Musk posting several emojis in response to posts on X about the hack.
That included a grimace in reply to a post reminding peopl that collapsed crypto exchange FTX had, like Binance today, said it had enough funds to cover clients' holdings.
In response, CZ reminded Musk that Binance owns a stake in his SpaceX business:
double quotation mark Elon, have a lot of respect for you, but bad time to troll. Please stop. Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support. Thanks!
Binance's chief customer service officer Yi He weighed in too, saying:
double quotation mark Reporting to the major shareholder: Our company's revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares you are bullish on.
The tech-focused Nasdaq is also suffering early losses: it's down 2.5%.
Chip stocks are leading the sell-off, after Intel startled Wall Street last night with surprisingly weak financial forecasts.
Shares in Intel, which warned of a “slowdown†in the PC market, have plunged by almost 29% in early trading, with rival AMD (-9.3%) and chip designed ARM (-9.9%) close behind.
